From 0a2d074b8b815051d0ee268de26150c5b4600ac3 Mon Sep 17 00:00:00 2001
From: Adam Wright <668955+adamjohnwright@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:29:10 -0400
Subject: [PATCH] run_arm.sh: refuse an arm NAME starting with '-'

`scripts/run_arm.sh --help` started a real arm named "--help" on the current
catalog: the name check allowed a leading dash. It now dies with the usage
line before anything starts; bench/test_run_arm_guard.py pins it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 bench/test_run_arm_guard.py | 20 ++++++++++++++++++++
 scripts/run_arm.sh          |  4 +++-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 bench/test_run_arm_guard.py

diff --git a/bench/test_run_arm_guard.py b/bench/test_run_arm_guard.py
new file mode 100644
index 0000000..699fa7f
--- /dev/null
+++ b/bench/test_run_arm_guard.py
@@ -0,0 +1,20 @@
+"""run_arm.sh refuses an arm NAME that starts with '-'.
+
+`scripts/run_arm.sh --help` used to start a real arm named "--help" against
+the current catalog (2026-10-09): the name check allowed a leading dash. The
+guard must fire before anything is started, so this runs the script itself.
+"""
+import pathlib
+import subprocess
+
+import pytest
+
+SCRIPT = pathlib.Path(__file__).resolve().parent.parent / "scripts" / "run_arm.sh"
+
+
+@pytest.mark.parametrize("name", ["--help", "-h", "-x"])
+def test_a_leading_dash_is_refused_before_anything_runs(name):
+    r = subprocess.run(["bash", str(SCRIPT), name], capture_output=True, text=True, timeout=30)
+    assert r.returncode == 1
+    assert "not start with '-'" in r.stderr
+    assert "usage:" in r.stderr
diff --git a/scripts/run_arm.sh b/scripts/run_arm.sh
index 8942fce..7dc4597 100755
--- a/scripts/run_arm.sh
+++ b/scripts/run_arm.sh
@@ -42,7 +42,9 @@ die() { echo "run_arm: $*" >&2; exit 1; }
 
 [ $# -ge 1 ] || die "usage: scripts/run_arm.sh NAME [--server K=V]... [--bench K=V]... [--port N]"
 NAME=$1; shift
-[[ "$NAME" =~ ^[A-Za-z0-9._-]+$ ]] || die "NAME must be [A-Za-z0-9._-]+"
+# A leading '-' is refused: `run_arm.sh --help` used to start a real arm named
+# "--help" on the current catalog (2026-10-09).
+[[ "$NAME" =~ ^[A-Za-z0-9._][A-Za-z0-9._-]*$ ]] || die "NAME must be [A-Za-z0-9._-]+ and not start with '-' (usage: scripts/run_arm.sh NAME [--server K=V]... [--bench K=V]... [--port N] [--catalog ID] [--max-edges N])"
 SERVER=(); BENCH=(); PORT=8090; LIMIT=(); CATALOG_ID=""; MAX_EDGES=40000
 while [ $# -gt 0 ]; do
   case "$1" in